Cipher Tools

Introduction

Cipher tools live under Tools → Cipher in the main navigation. Each calculator is dedicated to a single algorithm family and exposes the inputs typically required for payment-system testing: hex keys, hex data, IV/tweak values, and mode/padding selectors. Every operation is recorded in the activity log with timestamps and round-trip values.

Common UI Patterns

All cipher calculators share the same conventions:

• Two-pane layout — Inputs on the left, an activity log on the right that records every operation with timestamps and inputs.
• Data Input Type — Most tools have an ASCII / Hexadecimal drop-down so you can paste data either way; the field label changes based on the selection.
• Hex keys — Keys are always entered as continuous hexadecimal (no spaces, no 0x prefix). Length is validated live.
• Encrypt / Decrypt buttons — Pair of explicit buttons rather than an Encrypt/Decrypt toggle.
• Copy buttons — Each output supports one-click copy to clipboard.

AES Calculator

Encrypt or decrypt data with AES, or compute a Key Check Value over a known key.

Inputs

Walk-through

1. Pick AES Type — AES-128, AES-192, or AES-256.
2. Pick Mode — Choose a cipher mode, or pick KCV to compute a key check value.
3. Pick Data Input Type — ASCII or Hexadecimal.
4. Enter Input Data — In KCV mode the input is ignored; otherwise this is the plaintext or ciphertext.
5. Enter Key (Hex) — A hex key whose length matches the AES type.
6. Enter IV — If the mode requires one, enter 32 hex chars in the Initial Vector (IV) (Hex) field.
7. Click Encrypt / Decrypt — Or Calculate KCV when the mode is KCV. The result is appended to the right-hand activity log with a byte count.

Example

AES Type:        AES-128
Mode:            CBC
Data Input Type: Hexadecimal
Key (Hex):       000102030405060708090A0B0C0D0E0F
IV (Hex):        00000000000000000000000000000000
Input Data:      6BC1BEE22E409F96E93D7E117393172A

Output:          7649ABAC8119B246CEE98E9B12E9197D

DES / 3DES Calculator

Single DES or Triple DES with a wide selection of cipher modes and padding schemes commonly used by legacy payment hosts.

Inputs

Walk-through

1. Pick Algorithm — DES for single DES, 3DES for double or triple length keys.
2. Pick Mode — ECB or CBC for the typical case; CFB-8/CFB-64/OFB-8/OFB-64 for streaming variants.
3. Pick Padding — Pick the scheme expected by your host. ISO 9797-1 Method 1 or Method 2 are common in payments.
4. Pick Data Input Type — ASCII or Hexadecimal.
5. Enter Input Data in the matching format.
6. Enter Key (Hex) — The variant (DES, 2-key 3DES, 3-key 3DES) is inferred from the key length you provide.
7. Enter IV if a chaining mode is selected.
8. Click Encrypt / Decrypt — The result card displays the output in HEX, plus an ASCII view if the bytes are printable, with copy / clear actions.

Use Cases

• Encrypting / decrypting PIN blocks under a working key (TPK / PEK).
• Generating 3DES MACs by chaining ECB operations.
• Verifying ZPK / ZMK translations during HSM integration.

FPE Calculator

Format-Preserving Encryption keeps the output in the same format as the input — e.g. encrypting a 16-digit PAN into another 16-digit numeric string. Useful for tokenisation and PCI-scope reduction.

Tabs (5)

Each tab is a self-contained calculator for the named variant:

• FPE-FF1
• FPE-FF2 (VAES3)
• FPE-FF3
• FPE-FF3-1
• FPE-DFF[OFF-2]

Inputs (per tab)

Walk-through

1. Pick the FPE tab matching your spec — FPE-FF1 or FPE-FF3-1 for new work.
2. Pick Radix — 10 for numeric tokens such as PANs.
3. Pick Encryption Type — the AES variant for the underlying block cipher.
4. Pick Key Input Type and enter the Key.
5. (FF1 only) tick Use Tweak? if you have one, then enter it.
6. Enter Data — The string must contain only characters in the radix alphabet.
7. Click Encrypt or Decrypt — The output preserves the original length and alphabet.

Example: Tokenize a PAN (FPE-FF1)

Radix:           10
Encryption Type: AES-128
Key Input Type:  Hexadecimal
Key:             2B7E151628AED2A6ABF7158809CF4F3C
Use Tweak?:      on
Tweak:           39383736353433323130
Data:            0123456789012345

Output:          6124200211725605

RSA Calculator

Six-tab tool covering the full RSA workflow from key generation through padding-aware encryption and signing.

Tabs (6)

• Keys — Generate or paste a key pair.
• Encrypt — Encrypt with PKCS1 or no padding.
• Decrypt — Decrypt ciphertext with the corresponding key.
• Sign — Produce a signature over a message or hash.
• Verify — Verify a signature against a hash.
• OAEP — Encode / decode with OAEP padding.

Keys Tab

• Key Length (bits) — 1024, 2048, 3072, 4096.
• Generate Keys button.
• Modulus, Public Exponent (e), Private Exponent (d) — All hex; you can also paste pre-existing components instead of generating.

Encrypt Tab

• Encoding Method — Public (encrypt with public key) or Private.
• Padding — PKCS1 or No Padding.
• Input Data Format — ASCII or Hex.
• Data to Encrypt.
• Button: Encrypt.

Decrypt Tab

• Decoding Method — Private or Public.
• Padding — PKCS1 or No Padding.
• Data to Decrypt (Hex).
• Button: Decrypt.

Sign / Verify Tabs

• Sign — Input Data Format (ASCII / Hex) and Data to Sign; click Sign.
• Verify — Hash (Hex) and Signature (Hex); click Verify.

OAEP Tab

• Method — Encode or Decode.
• Hash Function — SHA-1, SHA-224, SHA-256, SHA-384, SHA-512.
• Result Length (bits) — 1024, 2048, 4096.
• Data (Hex), Encoding Parameters (Label, Hex).
• Button label changes between Encode and Decode based on the selected method.

Thales RSA Calculator

Vendor-aware RSA helpers tailored to Thales PayShield workflows.

Tabs (3)

Generate

Construct an RSA key pair from CRT components (or generate a fresh one). Inputs:

• Private Exp. (d)
• Prime 1 (p)
• Prime 2 (q)
• Exponent 1 (dModP1)
• Exponent 2 (dModQ1)
• Coefficient (iqmp)
• Key Length (1-4096)

Buttons: Generate (d) from Components, Generate New Random Key.

Thales Key Block

Wrap or unwrap a key pair under a Key Block Protection Key. Inputs:

• DES KBPK, AES KBPK
• Public Key Header, Private Key Header
• Key Block Encryption — AES or DES.
• Input Format — ASCII or Hex.
• Public Key, Private Key

Buttons: Wrap Key Block, Unwrap Key Block.

Thales LMK Variant

Apply Thales LMK variants. Inputs:

• LMK Pair 34-35
• LMK Pair 36-37
• Authentication Data
• Modulus Encoding — DEC / DER variants.
• Public Key, Private Key

Button: Process LMK Variant.

ECDSA Calculator

Elliptic Curve Digital Signature Algorithm with three workflow tabs.

Keys Tab

• ECC Curve Name — NIST P-256, NIST P-384, NIST P-521, plus the Brainpool curve variants.
• Private Key (Hex).
• Public Key (Hex).
• Public Key Form — Uncompressed or Compressed.

Buttons: Generate New Public Key, Is Point on Curve?, Generate Random Key Pair, Validate Current Key Pair.

Sign Tab

• Hash Type — SHA-1, SHA-256, SHA-384, SHA-512.
• Input Data Format — ASCII or Hex.
• Data to Sign.

Button: Sign Data. Output is the (r, s) pair in hex.

Verify Tab

• Hash (Hex).
• Signature (Hex).

Button: Verify Signature.

Cipher Modes Reference

Mode availability depends on the calculator. AES exposes ECB / CBC / CFB / OFB / KCV. DES / 3DES exposes ECB, CBC, and the CFB-8 / CFB-64 / OFB-8 / OFB-64 byte/feedback variants.

Padding Schemes (DES / 3DES)

The DES / 3DES calculator exposes the full set of padding schemes used across legacy and modern payment protocols. Pick the one your host expects:

Tips

• Use the Bitmap Calculator in the Utility Tools to inspect block alignment when sizes look odd.
• For HSM-bound keys, prefer Thales RSA → Thales Key Block over the raw RSA tool to keep wrapping consistent.
• If a known answer test fails, double-check the IV is in hex (not ASCII) and the data length matches the mode requirements.